When successful CSRF attacks are executed they have the ability to access credentials and other information between the victim and the site. Are the sites username and password that are stored in the password manager also visible? Or is that out of the scope for this attack?
The term "CSRF" is very broad and, in my opinion, your definition of CSRF is not entirely accurate. A CSRF vulnerability's abilities depend on what endpoint is actually vulnerable to CSRF. Being able to send a request on behalf of a user that changes their profile picture, for example, wouldn't fall under your definition of CSRF above. If you have discovered a CSRF vulnerability on
example.com, for instance, this does not necessarily affect your password manager per se. A far more significant attack in the context of password managers, is stored XSS or a subdomain takeover whereby an adversary can trick the victim's password manager into auto-filling a sign-in form, because the password manager trusts the origin.
It sounds to me like this is probably what you had in mind but were associating this attack vector with CSRF. On the other hand, a CSRF vulnerability in your password manager might be something to be concerned about, but that is a vulnerability in the password manager itself and not the page the user is currently visiting.